Slashdot Mirror
Google Voice Fixes Security Flaw, Almost
gardel writes "Google appears to have fixed a significant security hole in its two-week-old Voice calling service though some vulnerabilities remain. Until about 7pm PDT Tuesday, an unauthorized party could use a SIP device to spoof a phone number attached to a Google Voice account to call the Google Voice number, giviing the spoofer access to greetings and voicemail, and the ability to make outbound calls, including expensive international calls. Though spoofing via SIP is no longer possible, continued existence of some vulnerability was still apparent Tuesday night. Voxilla was able to set the caller ID of a PBX extension to a mobile number attached to Google Voice account and call in, using a business VoIP trunk, to gain access."
I refer you to my signature:
I'll subscribe to Slashdot when I see a month without a dupe, a typo, or an article the "editors" didn't read.
Comment removed based on user account deletion
Hackers, meet the Phreakers, Phreakers, meet the Hackers. Have fun!!
Not the google actually does, but you'll find plenty of VoIP setups that you can trick this way.
Its too simple to configure these setups to trust outside caller id info (which is trivial to fake since most of the time no one checks to make sure the info being sent is allowed from the line) and to use that info for authentication to voicemail automatically.
Its kind of like considering * a trusted host for rsh/rcp and when you turn a nice pointy/clicky gui over to a random person to admin your phone system, it ends up happening pretty often. Save money right up till you get that massive phone bill cause some guy was bouncing calls off you.
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
This sort of thing really is inevitable. With the merging of more and more systems onto the internet, you're going to have a lot more malicious people much more accessible to your data. It used to be phone networks were either too slow, or just too inaccessible for all but really determined people, or one that has a captain crunch whistle... but now, even the dumbest script kiddie can begin to go after systems that have even small vulnerabilities.
The musings of just another geek and his junk.
Where expensive is an arbitrary number between the inability to use an internet chat program and proprietary price gouging?
That, or "expensive international calls" is a euphemism for "phone sex".
David Gould
main(i){putchar(340056100>>(i-1)*5&31|!!(i<6)<< 6)&&main(++i);}
I took down google voice with my captain crunch whistle.
Is it still vulnerable to Woz's blue box?
It's not like any of us can get a Google Voice account right now anyway.
I still haven't figured out exactly what it is. Can you call out via Google Voice? Does it act as a regular SIP provider? What the hell is the point of Google Voice?
Voxilla was able to set the caller ID of a PBX extension to a mobile number attached to Google Voice account and call in, using a business VoIP trunk, to gain access.
This has been true since early days of Grand Central. I really hope they would fix this, but I doubt they will. Basically, everyone knows you can't trust Caller ID, , but they chose to do so anyway. I bet this was a business decision to allow easier use of the voicemail in order to compete with cellphone provider voicemail.
-Em
RelevantElephants: A Somatic WebComic...
It's just some data that can be faked. As long as you have a trunk line like T1 to the Telco, or something similar, you are responsible to generate the Caller ID instead of the Telco.
So what's so surprising here? It just doesn't work to use it for authentication.
What does it take to get into Grand Central? I've been signing up over and over for a year now.
Even better, I don't have to press 1 any more to answer a call! So annoying when using a headset and your phone is tucked away somewhere.
Wasn't the CIP device destroyed? Is there a second CIP device that Starkwood was keeping in reserve? And what the hell does Google have to do with anything?
It is nice that you can turn off Call Presentation now. I wish, as I did with Grand Central, that the level of configurability would get way higher. Things like having certain people's calls go through without the Call Presentation thing.
It would also be nice if the system was complex enough to understand voice commands in addition to the numbers. The biggest pain I have is answering a call on my iPhone requires changing over to keypad mode every time to hit '1'. However, it pays for itself when I manage to avoid a call that I really didn't want to take.
Another sweet feature: the contacts are now held in your Google Contacts stuff (shared with Gmail, which caused me a few initial problems), so that you can sync that up with the iPhone (and I presume other phones somehow) as well. It's really becoming a Googlefied world.
Things like having certain people's calls go through without the Call Presentation thing.
You can do that! It's configurable by groups.
The odds of your unactivated card falling into the hands of somebody who has the ability to modify the Caller ID info is most likely pretty slim.
And having a card fall into the hands of somebody spoofing Caller ID to activate them means said person is doing some serious criminal shit. In other words, having the card activated is the least of anybody's worry.
In other words, security is a balance. Activating your card from a "home phone" just weeds out casual criminals who stumble on your mail--not hard-core people doing this shit for a living.